This host is running Symantec Web Gateway and is prone to directory traversal vulnerability.

Successful exploitation could allow attackers to read arbitrary files via directory traversal attacks and gain sensitive information. Impact Level: Application

Upgrade to Symantec Web Gateway version 5.0.3 or later For updates refer to http://www.symantec.com/business/web-gateway

The flaw is due to an improper validation of user-supplied input passed via the 'relfile' parameter to the '/spywall/releasenotes.php', which allows attackers to read arbitrary files via a ../(dot dot) sequences.

Symantec Web Gateway versions 5.0.x before 5.0.3

• http://osvdb.org/82024
• http://secunia.com/advisories/49216
• http://www.securityfocus.com/bid/53442
• http://www.symantec.com/business/web-gateway
• http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120517_00

---

Updated on 2015-03-25